{"slug": "google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the", "title": "Google Ships a Managed Agent Harness With Credentials That Never Touch the Sandbox", "summary": "Google shipped a preview of Managed Agents in the Gemini API in September 2026, introducing the antigravity-preview-09-2026 environment and upgrading the default model from Gemini 3.5 Flash to Gemini 3.8 Flash. The release's core is a Credentials API that uses an egress proxy to inject tokens such as Authorization: Bearer headers on the fly, so secrets never reside in the ephemeral Linux sandbox where the agent executes. The launch is part of a week in which four vendors shipped distinct agent credential architectures, including Rubrik's short-lived scoped tokens co-engineered with Anthropic, Microsoft's MCP Firewall in Entra Agent ID, and NVIDIA's named-provider credentials in OpenShell's policy-based sandboxing layer.", "body_md": "## The Hidden Architecture of Google’s Managed Agents\n\nOn the surface, the recent update to Google’s [Managed Agents](https://blog.google/innovation-and-ai/technology/developers-tools/managed-agents-gemini-api/) in the Gemini API appears to be a standard SDK iteration. The September 2026 preview, which introduces the *antigravity-preview-09-2026* environment and upgrades the default model from Gemini 3.5 Flash to Gemini 3.8 Flash, is certainly a welcome performance boost for developers. However, the true significance of this release lies not in the model versioning, but in the underlying Credentials API architecture that Google has deployed to manage agent security.\n\nThe core of this new harness is a sophisticated approach to credential handling that fundamentally changes how agents interact with external services. By utilizing an egress proxy model, Google ensures that sensitive secrets never actually reside within the ephemeral Linux sandbox where the agent executes. When an agent needs to authenticate with an external API, the proxy performs HTTP header transforms — such as injecting an *Authorization: Bearer* token — on the fly. The model itself never sees these raw tokens, and they are never embedded in the sandbox code or environment variables. This architectural choice represents a distinct strategy for mitigating the risks inherent in autonomous agent execution.\n\nThis development is part of a broader, rapid formalization of the [agent identity](https://forkast.news/glossary/agent-identity/) and governance stack. In a single week in September 2026, four major vendors introduced four distinct credential architectures, highlighting the industry’s intense focus on securing agentic workflows. Beyond Google’s egress proxy, [Rubrik implemented short-lived scoped tokens](https://forkast.news/rubrik-ships-mcp-for-enterprise-ai-agents-co-engineered-with-anthropic/) co-engineered with Anthropic, [Microsoft added MCP Firewall](https://forkast.news/mcp-is-becoming-the-governance-surface-three-enterprise-vendors-shipped-policy-enforcement-through-the-protocol-this-week-2/) to Entra Agent ID for discovering and controlling agent MCP server usage, and NVIDIA shipped named-provider credentials in [OpenShell’s policy-based sandboxing layer](https://forkast.news/nvidia-openshell-ships-policy-based-sandboxing-as-a-runtime-enforcement-layer-for-autonomous-agents/). These moves collectively signal that the industry is moving past the experimental phase of agent deployment and into a period of rigorous infrastructure hardening.\n\nThe governance stack is now clearly delineated into four functional layers: build-time policy enforcement, such as that provided by Cisco’s Agent SDK; runtime management, exemplified by WSO2 Agent Manager and NVIDIA OpenShell; data-security layers like Rubrik’s [MCP](https://forkast.news/glossary/model-context-protocol-mcp/) implementation; and now, the managed harness layer represented by Google. By providing a standardized environment that handles both the execution sandbox and the credential lifecycle, Google is positioning itself as a foundational provider in this emerging stack.\n\nThe developer experience within this harness is also highly structured. Configuration is managed through version-controllable files: *AGENTS.md*, which is auto-loaded as system instructions for persona and guideline definition, and *SKILL.md*, which allows for the modular extension of agent capabilities. These files, which can be mounted from Git repositories or Google Cloud Storage objects, ensure that agent behavior is as reproducible and auditable as the application code itself.\n\nDespite these advancements, several questions remain regarding the long-term interoperability of these disparate governance models. As enterprises begin to mix and match tools from different vendors, how will these varied credential architectures — proxy-based, token-based, and identity-based — interact within a single, complex agentic workflow? Furthermore, as the industry continues to iterate on these layers, we must consider whether the current trend toward vendor-specific managed harnesses will lead to a unified standard or a fragmented landscape of proprietary security models. For now, Google’s approach provides a clear, robust path for developers looking to balance agent autonomy with enterprise-grade security.", "url": "https://wpnews.pro/news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the", "canonical_source": "https://forkast.news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the-sandbox/", "published_at": "2026-09-18 11:09:26+00:00", "updated_at": "2026-09-18 11:25:18.996800+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "agent-protocols", "ai-infrastructure", "ai-safety"], "entities": ["Google", "Gemini API", "Managed Agents", "Gemini 3.8 Flash", "Rubrik", "Anthropic", "Microsoft", "NVIDIA"], "alternates": {"html": "https://wpnews.pro/news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the", "markdown": "https://wpnews.pro/news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the.md", "text": "https://wpnews.pro/news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the.txt", "jsonld": "https://wpnews.pro/news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the.jsonld"}}